The present invention relates to a process for monitoring the correct function of a program-controlled electronic circuit, such as a microprocessor, microcomputer, microcontroller, or the like, wherein in the working cycle data processing results are checked for partial or complete correlation with data which are produced independently of the circuit to be monitored and independently of the program run in a monitoring circuit, and wherein if deviations indicative of a malfunction occur, an error signal or disabling signal is generated. Circuit arrangements for implementing the process are also comprised in the present invention.
The correct operation of microcomputers and other program-controlled electronic circuits must be monitored especially when the circuits are used for safety-critical control systems. An example of a safety-critical application is the controlling intervention in the brake system of an automotive vehicle, as required, among others, for anti-lock control, traction slip control, driving stability control, etc. When a malfunction of the electronic unit is detected, the electronic control in prior art brake systems is disconnected in order to maintain at least the braking function, even though without anti-lock control. It is also known in the art to deactivate the control only in part, to disconnect it with delay or to switch it over in any other way to a less dangerous condition when defined faults occur.
It is important for such monitoring measures that the malfunction is identified quickly and with a high degree of reliability. To this effect, the input data produced by wheel sensors are processed in the control circuit disclosed in German patent No. 32 34 637 in two parallel, independent, identically designed and identically programmed microcontrollers. The output signals of the two microcontrollers are then checked for correlation. When deviations occur, indicative of a malfunction, the electronic control will be disabled so that the braking function is ensured. Thus, the prior art control circuit is based on a redundant signal processing in two complete, program-controlled circuits. The sole purpose of the redundance is to identify errors with a high degree of reliability in order to disable the control in this case. The disabling mechanisms on their part are also virtually redundant. Thus, considerable effort and equipment is involved for safety reasons.
In another prior art circuit arrangement, as disclosed in German patent application No. 41 37 124, the sensor signals or input signals are processed in two parallel microcontrollers. Only one of the microcontrollers, however, carries out the complete, sophisticated signal processing operation. The second circuit is mainly used for monitoring. Therefore, the input signals, after conditioning and the production of derivatives, are further processed by simplified control algorithms and a simplified control philosophy. Compared to the above mentioned state of the art circuit, the effort and equipment is reduced by the simplified processing in the monitoring microcontroller.
It would principally be possible nowadays to incorporate a plurality of complete circuit systems, for example, two microcomputers, on one single chip, to supply them with identical input data and to compare the data processing results of the different circuit systems for monitoring the correct functioning. However, in such an electronic circuit design, it cannot be ruled out with a sufficiently high degree of reliability that a correct monitoring signal (watchdog signal) will be generated due to a fault in the circuit even if the data processing results of both circuit systems are not in correlation, or a circuit system is defective.
A "one-processor solution", i.e. the limitation to one single programmed circuit with a monitoring circuit of conventional type, does not at all permit a sufficiently reliable identification of malfunctions.
Further, German patent application No. 40 04 782 discloses an ABS system with two microcontrollers which both generate a monitoring signal that represents an alternating signal with a predetermined frequency and a predetermined sequence. A safety circuit compares the alternating signals with a time normal derived from a clock generator which is independent of the working cycle of the microcontroller. A change in the alternating signal as well as failure of the time normal causes deactivation of the anti-lock control. When the pulses fall from the predetermined time window, the control will be disabled. The above state-of-the-art circuit arrangement is based on the use of two microcontrollers of redundant operation.